سياسة الخصوصية

Privacy Policy (English)

Al-Muqbil Family app · Effective 7 November 2026. The Arabic text above is the primary version.

Who is responsible. Omar Almuqbil, an individual, a member of the family and the app's founder, in Buraidah, Al-Qassim, Saudi Arabia (not a company). Contact: Oalmuqbil@gmail.com. The app is private to the Al-Muqbil family; only people linked by a relative or accepted by a supervisor enter the family space.

What we collect

• Account: mobile number, display name, language, number and calendar settings, and when you accepted the terms. Older accounts made before phone sign-in may hold an email address.
• Membership: your role, branch, linked record, who linked you and how, notification preferences and quiet hours, and any suspension and its reason.
• Family record: what the family enters about its members, with or without accounts: name, nickname, gender, living or deceased, birth order, birth and death dates, photo, parents and marriages, and a spouse's family. The mother's name is visible to supervisors only.
• Profile: what you choose to add, such as display name, occupation, employer, city, mobile number, email, bio and social links, each with a privacy level you choose. The profile belongs to your record in the tree, not to your account.
• Join request: your message, the name you claim, your lineage as you write it, your closest relative, gender, and spouse details if given.
• Content: news, events, RSVPs, albums, photos, videos, documents, lineage cards, badges, and members' projects shown on Home, with daily aggregate view and tap counts that identify no one.
• Messages to family admins and edit requests: what you write in "Contact the family admins" is kept, with your name, as a notification for the founder and admins; edit requests and their contents.
• Expertise profile (if you turn it on): title, organisation, field, help topics and whether you accept messages.
• Messages: your private messages and their image or PDF attachments. No supervisor opens conversations. If either side reports a conversation, its last 20 messages, with sender names and text, are copied for supervisors to review.
• Family audit log: important changes, such as edits to a record or a permission: who made them, when, and the values before and after.
• Device and logs: an app-generated device ID, device name and platform, push token and last use. The server logs each request's IP address, path and user agent to protect the service and limit request rates.
• Sign-in code: not stored in the database; a hashed trace is kept for 5 minutes and works once.

Device access

• Location: only when you tap "My location" while placing an event. Your precise location is used once to move the map and is not stored or tracked in the background. Only the place you confirm is saved with the event.
• Camera: only to scan a relative's link code. The app takes no photos.
• Photos and files: you pick them yourself; the app asks to add to your photos only to save a lineage card. Location and other metadata are removed from uploaded photos and videos. PDF files are stored as uploaded.
• No access to contacts, microphone or calendar, and no advertising identifier.

Crash reports

We use Sentry. A crash report holds the error, device model and OS, app version, your internal account ID, the family's short name, your role, the screen name, and a short trail of screens and server calls before the crash; session health (whether a session ended in a crash) is also recorded. No screenshots and nothing you type; mobile numbers, emails and URL details are masked. The server reports its own errors to Sentry without user data or request contents.

Why we use it

To sign you in by mobile number, show the tree and content to family members under privacy settings and roles, review join, link and edit requests, send the notifications you choose, review reports and protect members, and keep the service running, fixed and backed up. We process data to provide the service you asked for by creating an account and joining the family, and with your consent at sign-up. We do not sell data, show ads from ad networks (the members' projects on Home are approved by supervisors), or track you across other apps or websites.

Who receives it

• Family members, by each field's privacy and each role's permissions. Hidden fields are removed by the server and never reach your device. Supervisors review requests and reports and manage the record.
• Service providers, only as needed: OVH (server, database and file storage, Canada); Mwasel (WhatsApp delivery of the sign-in code: receives your mobile number, the code and the family name, and the message passes through WhatsApp); an independent backup storage provider (backups are encrypted before leaving the server); Sentry (crash reports, United States); Google Firebase (push delivery: the family name and a short text such as a sender's name or a news title, possibly the text of a message to the family admins, never the text of private messages); Google Maps (map display; place searches go through our server, so Google receives the search text and map position); Google Drive (only when an album is imported from a link pasted by someone with that permission; the link is not kept after the import).
• Authorities, where the law requires.

Transfers outside Saudi Arabia

The server is in Canada, crash reports are processed in the United States, and Google, WhatsApp and the backup provider operate outside Saudi Arabia. These transfers are needed to provide the service you asked for and are limited to what each service needs. Safeguards we apply include encryption in transit, encrypted backups, masking numbers and emails in crash reports, and keeping private message text out of notifications.

Retention

• Account: until you delete it; deletion is immediate (see account deletion).
• Family record and its profile: stay with the family after deletion, including today the profile fields you added (number, email, bio, occupation, city, social links) until you ask for their removal.
• Sessions: deleted 30 days after sign-out or expiry; a session lasts at most 180 days.
• Notifications: read ones after 90 days, unread ones after one year.
• Messages and attachments: no set period, and the app has no way to delete them; they stay while the family space exists. Email us to remove what concerns you.
• Content and uploaded files: no set period; they stay while the family space exists or until someone with the permission deletes them.
• Family audit log: each entry is deleted once it is 24 months old.
• Copies of reported conversations: deleted 12 months after the report is closed, and kept while it is open. Before then you may ask us to delete what concerns you in them or in the audit log, unless a law or a report investigation prevents it.
• Server logs: overwritten automatically as their limited space fills, with no fixed time.
• Crash reports and delivery data at providers: Sentry deletes crash reports automatically under its service's retention period; they carry an internal account ID, not your number. Firebase and Mwasel keep delivery data under their own policies.
• Backups: deleted automatically; the oldest is about 7 months old, so deleted data may remain in them for that long. The hosting provider's own daily copy keeps only the last 24 hours.

Your rights

Under Saudi Arabia's Personal Data Protection Law you may be informed, access your data or get a copy, have it corrected or deleted, and withdraw consent. In the app you can edit your profile and each field's privacy and delete your account; ask your family supervisor to correct the family record. For anything else, including a copy of your data (the app has no export yet), email Oalmuqbil@gmail.com; we reply within 30 days and may verify your identity first. You may complain to the Saudi Data and AI Authority (SDAIA).

Security

Data is encrypted in transit; files open only through short-lived signed links after a permission check; backups are encrypted before leaving the server; each family is isolated in the database.

Age

Accounts are for people aged 13 and over. If we learn an account holder is younger, we delete the account. The family record may name children, entered by their relatives or the family's supervisors, without an account for them.

Changes

We announce material changes on this page before they take effect and update the effective date.